CVE-2026-21095 is a critical heap based buffer overflow (CVSS 9.8) in the DNG decoder of libimagecodec.quram.so on Samsung Android devices. Remote attackers could execute arbitrary code. Samsung fixed it in SMR Sep-2026 Release 1, so install that security update or a later one.
What's affected
The record names the DNG decoder of libimagecodec.quram.so before SMR Sep-2026 Release 1. DNG is a raw photo format, and the library is Samsung's image codec. The weakness is CWE-122 (heap based buffer overflow). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
A sibling record, CVE-2026-21096, covers the JPEG decoder in the same library and has the same fix. The record does not mark either as exploited in the wild, and neither is in the CISA Known Exploited Vulnerabilities catalog. I could load the September 2026 bulletin page, but it did not show the CVE text, so check the bulletin for the list of affected models.
How to check if you're exposed
On a Samsung phone or tablet, open Settings, then About phone, then Software information, and read the Android security patch level. If it is earlier than 1 September 2026, the device is affected.
On managed fleets, filter your device management report for devices with a patch level before September 2026.
What to do now
- Install the latest Samsung software update on every device. September 2026 or later contains the fix.
- Confirm the new patch level after the update.
- Set a minimum patch level in your device management policy and report on devices below it.
- Isolate or replace devices that no longer get monthly security updates.
- Treat unexpected photo files, especially raw formats, from unknown senders with care until the update is in.
Why it matters
A heap overflow means a program writes more data to a memory area than the area can hold, and the extra data lands in whatever is next to it. The record rates it as allowing code execution, which is the worst result of this class. The decoder processes untrusted image files, and the format parser has to handle many shapes of input correctly, which is hard.
What raises the score is that images arrive by message, mail, download and web page, so the route to the parser is short. That is why image codec flaws on phones are fixed in a monthly platform update, and why leaving updates off is a risk.
Quick check
Does this affect all Android phones?
The record names Samsung devices, because the affected library is Samsung's. Other manufacturers should check their own bulletins.
Sources
Last reviewed: 19 October 2026.
